S3 Backup ... suspect access issue

[merefield]

Getting an Access Denied issue in error log … which seems to be causing Sidekiq to stay paused after backups!! (which is interesting on its own) - is my access policy on IAM not generous enough?:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::my-discourse-backups"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-discourse-backups/*"
            ]
        }
    ]
}

[merefield]

Going to try an element of this policy here:

IAM and bucket policy for S3 access

I noticed that all of the tutorials i found for Discourse S3 access granted the user absolute authority over the bucket – they allow ‘s3:*’ authority. This is an extremely unwise policy, since it allows significantly more control over the bucket than is reasonable. Should you be using S3 for Discourse backup storage, a rampaging attacker would be able to delete your bucket and your backups on the way out. There are two ways to combat this: One, a tighter policy… { "Version": "2012-10-17",…

[merefield]

Went with policy in the guide, will monitor for a few days before accepting this as solution:

Setting up file and image uploads to S3

So, you want to use S3 to handle image uploads? Here’s the definitive guide: S3 registration Head over to http://aws.amazon.com/s3/ and click on [image]. During the create account process, make sure you provide payment information, otherwise you won’t be able to use S3. There’s no registration fee, you will only be charged for what you use, if you exceed the free usage tier. User creation Creating a user account Sign in to AWS Management Console and click on [image] to access the AWS Identity…

[merefield]

Actually had to use a slightly different policy to make mine work,

I had to add:

       "s3:GetBucketLocation",

my top level one now looks like:

  "Statement": [
      {
       "Effect": "Allow",
       "Action": [
           "s3:HeadBucket",
           "s3:GetBucketLocation",
           "s3:ListAllMyBuckets"
      ],
       "Resource": "*"
    },

But otherwise based on:

Setting up file and image uploads to S3

So, you want to use S3 to handle image uploads? Here’s the definitive guide: S3 registration Head over to http://aws.amazon.com/s3/ and click on [image]. During the create account process, make sure you provide payment information, otherwise you won’t be able to use S3. There’s no registration fee, you will only be charged for what you use, if you exceed the free usage tier. User creation Creating a user account Sign in to AWS Management Console and click on [image] to access the AWS Identity…

[system]

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.